xredirect parameter can be used for phishing

The xredirect parameter is not verified and can be used to trick users to trust links to unsafe sites.

For example a link https://xwiki-instance.com/bin/login/XWiki/XWikiLogin?xredirect=//www.badboy.com/&vm=commentsinline.vm&loginLink=1
will show the correct XWiki login screen and after successful login the user will be redirected to the bad site.

This could be used in phishing mails to trick users into trusting a site.

Ideally XWiki would check url.trustedDomains from xwiki.properties for valid redirection targets.